<!DOCTYPE html>
<html lang="zh-CN">
<head>
    <meta charset="utf-8">
    <meta name="viewport" content="width=device-width, initial-scale=1">
    <meta name="keywords" content="Hexo Theme Redefine">
    
    <meta name="author" content="xiaoeryu">
    <!-- preconnect -->
    <link rel="preconnect" href="https://fonts.googleapis.com">
    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>

    
    <!--- Seo Part-->
    
    <link rel="canonical" href="https://xiaoeeyu.github.io/2023/11/26/kgbmessager解密/"/>
    <meta name="robots" content="index,follow">
    <meta name="googlebot" content="index,follow">
    <meta name="revisit-after" content="1 days">
    
    
    
        
        <meta name="description" content="本章主要内容为：   spawn&#x2F;attach时机的选择 主动调用 hook时机选择 制作自己的dex并动态加载 使用Z3求解&#x2F;符号执行">
<meta property="og:type" content="article">
<meta property="og:title" content="KGBMessager解密">
<meta property="og:url" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/index.html">
<meta property="og:site_name" content="xiaoeryu">
<meta property="og:description" content="本章主要内容为：   spawn&#x2F;attach时机的选择 主动调用 hook时机选择 制作自己的dex并动态加载 使用Z3求解&#x2F;符号执行">
<meta property="og:locale" content="zh_CN">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125105905234.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125110719813.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125111547356.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125112048538.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125113128443.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125115558462.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125115948170.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125121610998.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125171107281.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125123009573.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125123736772.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125124610567.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125124828366.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125221647017.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125205819457.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125210440418.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125222056250.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125222305478.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125221229811.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125221406006.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125222751338.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125223008964.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125223416442.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125223711810.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231126163043261.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231126163659903.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231126163607474.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231126173232715.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125231137756.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231126173636593.png">
<meta property="og:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231126173722880.png">
<meta property="article:published_time" content="2023-11-26T08:49:53.000Z">
<meta property="article:modified_time" content="2023-11-26T12:51:15.906Z">
<meta property="article:author" content="xiaoeryu">
<meta property="article:tag" content="Frida逆向与利用自动化">
<meta property="article:tag" content="Frida HOOK">
<meta property="article:tag" content="算法分析">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://xiaoeeyu.github.io/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125105905234.png">
    
    
    <!--- Icon Part-->
    <link rel="icon" type="image/png" href="/images/rabete.jpg" sizes="192x192">
    <link rel="apple-touch-icon" sizes="180x180" href="/images/rabete.jpg">
    <meta name="theme-color" content="#A31F34">
    <link rel="shortcut icon" href="/images/rabete.jpg">
    <!--- Page Info-->
    
    <title>
        
            KGBMessager解密 | xiaoeryu
        
    </title>

    
<link rel="stylesheet" href="/fonts/Chillax/chillax.css">


    <!--- Inject Part-->
    

    
<link rel="stylesheet" href="/css/style.css">


    
        
<link rel="stylesheet" href="/css/build/tailwind.css">

    

    
<link rel="stylesheet" href="/fonts/GeistMono/geist-mono.css">

    
<link rel="stylesheet" href="/fonts/Geist/geist.css">

    <!--- Font Part-->
    
    
    
    
    
    

    <script id="hexo-configurations">
    window.config = {"hostname":"xiaoeeyu.github.io","root":"/","language":"zh-CN","path":"search.xml"};
    window.theme = {"articles":{"style":{"font_size":"16px","line_height":1.5,"image_border_radius":"14px","image_alignment":"center","image_caption":false,"link_icon":true,"delete_mask":false,"title_alignment":"left","headings_top_spacing":{"h1":"3.2rem","h2":"2.4rem","h3":"1.9rem","h4":"1.6rem","h5":"1.4rem","h6":"1.3rem"}},"word_count":{"enable":true,"count":true,"min2read":true},"author_label":{"enable":true,"auto":false,"list":[]},"code_block":{"copy":true,"style":"mac","highlight_theme":{"light":"github","dark":"vs2015"},"font":{"enable":false,"family":null,"url":null}},"toc":{"enable":true,"max_depth":4,"number":false,"expand":true,"init_open":true},"copyright":{"enable":true,"default":"cc_by_nc_sa"},"lazyload":true,"pangu_js":false,"recommendation":{"enable":false,"title":"推荐阅读","limit":3,"mobile_limit":2,"placeholder":"/images/ball-0101.jpg","skip_dirs":[]}},"colors":{"primary":"#A31F34","secondary":null,"default_mode":"light"},"global":{"fonts":{"chinese":{"enable":false,"family":null,"url":null},"english":{"enable":false,"family":null,"url":null},"title":{"enable":false,"family":null,"url":null}},"content_max_width":"1000px","sidebar_width":"210px","hover":{"shadow":true,"scale":false},"scroll_progress":{"bar":false,"percentage":true},"website_counter":{"url":"https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js","enable":true,"site_pv":true,"site_uv":true,"post_pv":true},"single_page":true,"preloader":{"enable":false,"custom_message":null},"open_graph":true,"google_analytics":{"enable":false,"id":null}},"home_banner":{"enable":true,"style":"fixed","image":{"light":"/images/wallhaven-jxl31y.png","dark":"/images/wallhaven-o5762l.png"},"title":"XIAOERYU","subtitle":{"text":["明心见性，拨云见日","Don't wait, to create"],"hitokoto":{"enable":false,"show_author":false,"api":"https://v1.hitokoto.cn"},"typing_speed":100,"backing_speed":80,"starting_delay":500,"backing_delay":1500,"loop":true,"smart_backspace":true},"text_color":{"light":"#fff","dark":"#d1d1b6"},"text_style":{"title_size":"2.8rem","subtitle_size":"1.5rem","line_height":1.2},"custom_font":{"enable":false,"family":null,"url":null},"social_links":{"enable":true,"style":"default","links":{"github":"https://github.com/xiaoeeyu","instagram":null,"zhihu":null,"twitter":null,"email":"xiaoeryu@163.com"},"qrs":{"weixin":null}}},"plugins":{"feed":{"enable":false},"aplayer":{"enable":false,"type":"fixed","audios":[{"name":null,"artist":null,"url":null,"cover":null,"lrc":null}]},"mermaid":{"enable":false,"version":"9.3.0"}},"version":"2.8.2","navbar":{"auto_hide":false,"color":{"left":"#f78736","right":"#367df7","transparency":35},"width":{"home":"1200px","pages":"1000px"},"links":{"Home":{"path":"/","icon":"fa-regular fa-house"},"Archives":{"path":"/archives","icon":"fa-regular fa-archive"}},"search":{"enable":true,"preload":true}},"page_templates":{"friends_column":2,"tags_style":"blur"},"home":{"sidebar":{"enable":true,"position":"left","first_item":"menu","announcement":null,"show_on_mobile":true,"links":null},"article_date_format":"auto","excerpt_length":200,"categories":{"enable":true,"limit":3},"tags":{"enable":true,"limit":3}},"footerStart":"2022/8/17 11:45:14"};
    window.lang_ago = {"second":"%s 秒前","minute":"%s 分钟前","hour":"%s 小时前","day":"%s 天前","week":"%s 周前","month":"%s 个月前","year":"%s 年前"};
    window.data = {"masonry":false};
  </script>
    
    <!--- Fontawesome Part-->
    
<link rel="stylesheet" href="/fontawesome/fontawesome.min.css">

    
<link rel="stylesheet" href="/fontawesome/brands.min.css">

    
<link rel="stylesheet" href="/fontawesome/solid.min.css">

    
<link rel="stylesheet" href="/fontawesome/regular.min.css">

    
    
    
    
<meta name="generator" content="Hexo 6.3.0">
<style>.github-emoji { position: relative; display: inline-block; width: 1.2em; min-height: 1.2em; overflow: hidden; vertical-align: top; color: transparent; }  .github-emoji > span { position: relative; z-index: 10; }  .github-emoji img, .github-emoji .fancybox { margin: 0 !important; padding: 0 !important; border: none !important; outline: none !important; text-decoration: none !important; user-select: none !important; cursor: auto !important; }  .github-emoji img { height: 1.2em !important; width: 1.2em !important; position: absolute !important; left: 50% !important; top: 50% !important; transform: translate(-50%, -50%) !important; user-select: none !important; cursor: auto !important; } .github-emoji-fallback { color: inherit; } .github-emoji-fallback img { opacity: 0 !important; }</style>
</head>



<body>
	<div class="progress-bar-container">
	

	
	<span class="pjax-progress-bar"></span>
	<!--        <span class="swup-progress-icon">-->
	<!--            <i class="fa-solid fa-circle-notch fa-spin"></i>-->
	<!--        </span>-->
	
</div>

<main class="page-container" id="swup">

	

	<div class="main-content-container flex flex-col justify-between min-h-dvh">
		<div class="main-content-header">
			<header class="navbar-container px-6 md:px-12">
    <div class="navbar-content transition-navbar ">
        <div class="left">
            
                <a class="logo-image h-8 w-8 sm:w-10 sm:h-10 mr-3" href="/">
                    <img src="/images/rabete.jpg" class="w-full h-full rounded-sm">
                </a>
            
            <a class="logo-title" href="/">
                
                xiaoeryu
                
            </a>
        </div>

        <div class="right">
            <!-- PC -->
            <div class="desktop">
                <ul class="navbar-list">
                    
                        
                            

                            <li class="navbar-item">
                                <!-- Menu -->
                                <a class=""
                                   href="/"
                                        >
                                    <i class="fa-regular fa-house fa-fw"></i>
                                    首页
                                    
                                </a>

                                <!-- Submenu -->
                                
                            </li>
                    
                        
                            

                            <li class="navbar-item">
                                <!-- Menu -->
                                <a class=""
                                   href="/archives"
                                        >
                                    <i class="fa-regular fa-archive fa-fw"></i>
                                    归档
                                    
                                </a>

                                <!-- Submenu -->
                                
                            </li>
                    
                    
                        <li class="navbar-item search search-popup-trigger">
                            <i class="fa-solid fa-magnifying-glass"></i>
                        </li>
                    
                </ul>
            </div>
            <!-- Mobile -->
            <div class="mobile">
                
                    <div class="icon-item search search-popup-trigger"><i class="fa-solid fa-magnifying-glass"></i>
                    </div>
                
                <div class="icon-item navbar-bar">
                    <div class="navbar-bar-middle"></div>
                </div>
            </div>
        </div>
    </div>

    <!-- Mobile sheet -->
    <div class="navbar-drawer h-dvh w-full absolute top-0 left-0 bg-background-color flex flex-col justify-between">
        <ul class="drawer-navbar-list flex flex-col px-4 justify-center items-start">
            
                
                    

                    <li class="drawer-navbar-item text-base my-1.5 flex flex-col w-full">
                        
                        <a class="py-1.5 px-2 flex flex-row items-center justify-between gap-1 hover:!text-primary active:!text-primary text-2xl font-semibold group border-b border-border-color hover:border-primary w-full "
                           href="/"
                        >
                            <span>
                                首页
                            </span>
                            
                                <i class="fa-regular fa-house fa-sm fa-fw"></i>
                            
                        </a>
                        

                        
                    </li>
            
                
                    

                    <li class="drawer-navbar-item text-base my-1.5 flex flex-col w-full">
                        
                        <a class="py-1.5 px-2 flex flex-row items-center justify-between gap-1 hover:!text-primary active:!text-primary text-2xl font-semibold group border-b border-border-color hover:border-primary w-full "
                           href="/archives"
                        >
                            <span>
                                归档
                            </span>
                            
                                <i class="fa-regular fa-archive fa-sm fa-fw"></i>
                            
                        </a>
                        

                        
                    </li>
            

            
            
        </ul>

        <div class="statistics flex justify-around my-2.5">
    <a class="item tag-count-item flex flex-col justify-center items-center w-20" href="/tags">
        <div class="number text-2xl sm:text-xl text-second-text-color font-semibold">92</div>
        <div class="label text-third-text-color text-sm">标签</div>
    </a>
    <a class="item tag-count-item flex flex-col justify-center items-center w-20" href="/categories">
        <div class="number text-2xl sm:text-xl text-second-text-color font-semibold">14</div>
        <div class="label text-third-text-color text-sm">分类</div>
    </a>
    <a class="item tag-count-item flex flex-col justify-center items-center w-20" href="/archives">
        <div class="number text-2xl sm:text-xl text-second-text-color font-semibold">112</div>
        <div class="label text-third-text-color text-sm">文章</div>
    </a>
</div>
    </div>

    <div class="window-mask"></div>

</header>


		</div>

		<div class="main-content-body transition-fade-up">
			

			<div class="main-content">
				<div class="post-page-container flex relative justify-between box-border w-full h-full">
	<div class="article-content-container">

		<div class="article-title relative w-full">
			
			<div class="w-full flex items-center pt-6 justify-start">
				<h1 class="article-title-regular text-second-text-color tracking-tight text-4xl md:text-6xl font-semibold px-2 sm:px-6 md:px-8 py-3">KGBMessager解密</h1>
			</div>
			
		</div>

		
		<div class="article-header flex flex-row gap-2 items-center px-2 sm:px-6 md:px-8">
			<div class="avatar w-[46px] h-[46px] flex-shrink-0 rounded-medium border border-border-color p-[1px]">
				<img src="/images/rabete.jpg">
			</div>
			<div class="info flex flex-col justify-between">
				<div class="author flex items-center">
					<span class="name text-default-text-color text-lg font-semibold">xiaoeryu</span>
					
					<span class="author-label ml-1.5 text-xs px-2 py-0.5 rounded-small text-third-text-color border border-shadow-color-1">Lv5</span>
					
				</div>
				<div class="meta-info">
					<div class="article-meta-info">
    <span class="article-date article-meta-item">
        <i class="fa-regular fa-pen-fancy"></i>&nbsp;
        <span class="desktop">2023-11-26 16:49:53</span>
        <span class="mobile">2023-11-26 16:49:53</span>
        <span class="hover-info">创建</span>
    </span>
    
        <span class="article-date article-meta-item">
            <i class="fa-regular fa-wrench"></i>&nbsp;
            <span class="desktop">2023-11-26 20:51:15</span>
            <span class="mobile">2023-11-26 20:51:15</span>
            <span class="hover-info">更新</span>
        </span>
    

    
        <span class="article-categories article-meta-item">
            <i class="fa-regular fa-folders"></i>&nbsp;
            <ul>
                
                
                    
                        
                        <li>
                            <a href="/categories/Android%E9%80%86%E5%90%91/">Android逆向</a>&nbsp;
                        </li>
                    
                    
                
            </ul>
        </span>
    
    
        <span class="article-tags article-meta-item">
            <i class="fa-regular fa-tags"></i>&nbsp;
            <ul>
                
                    <li>
                        <a href="/tags/Frida%E9%80%86%E5%90%91%E4%B8%8E%E5%88%A9%E7%94%A8%E8%87%AA%E5%8A%A8%E5%8C%96/">Frida逆向与利用自动化</a>&nbsp;
                    </li>
                
                    <li>
                        | <a href="/tags/Frida-HOOK/">Frida HOOK</a>&nbsp;
                    </li>
                
                    <li>
                        | <a href="/tags/%E7%AE%97%E6%B3%95%E5%88%86%E6%9E%90/">算法分析</a>&nbsp;
                    </li>
                
            </ul>
        </span>
    

    
    
    
    
        <span class="article-pv article-meta-item">
            <i class="fa-regular fa-eye"></i>&nbsp;<span id="busuanzi_value_page_pv"></span>
        </span>
    
</div>

				</div>
			</div>
		</div>
		

		


		<div class="article-content markdown-body px-2 sm:px-6 md:px-8 pb-8">
			<p>本章主要内容为：</p>
<blockquote>
<ol>
<li>spawn/attach时机的选择</li>
<li>主动调用</li>
<li>hook时机选择</li>
<li>制作自己的dex并动态加载</li>
<li>使用Z3求解/符号执行</li>
</ol>
</blockquote>
<span id="more"></span>

<hr>
<p>本章用<code>KGB Messenger</code>为案例来进行</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125105905234.png" class="" title="image-20231125105905234">

<ul>
<li>弹窗提示只能运行在Russian的设备上，回头可以再jadx里面搜索这个字符串定位</li>
</ul>
<h4 id="惯例先用jadx打开拿到包名，然后用objection查看一下基本信息"><a href="#惯例先用jadx打开拿到包名，然后用objection查看一下基本信息" class="headerlink" title="惯例先用jadx打开拿到包名，然后用objection查看一下基本信息"></a>惯例先用jadx打开拿到包名，然后用objection查看一下基本信息</h4><img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125110719813.png" class="" title="image-20231125110719813">

<ul>
<li>查看activity，都可以直接跳转过去</li>
</ul>
<h2 id="开始分析"><a href="#开始分析" class="headerlink" title="开始分析"></a>开始分析</h2><h3 id="通过地区校验"><a href="#通过地区校验" class="headerlink" title="通过地区校验"></a>通过地区校验</h3><p>这个地区校验比较简单，只是检查一下主目录</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125111547356.png" class="" title="image-20231125111547356">

<ul>
<li>搜索字符串可以直接定位的到</li>
</ul>
<p>定位到这里之后</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125112048538.png" class="" title="image-20231125112048538">

<ul>
<li><p>可以看到这里有<strong>两次校验</strong>，校验通过才能进入到<code>LoginActivity.class</code></p>
<blockquote>
<p>第一次校验：<code>System.getProperty</code>方法的返回值等于“Russia”，就能通过</p>
<p>第二次校验：<code>System.getenv</code>方法的返回值等于白名单中的值，就能通过</p>
</blockquote>
</li>
</ul>
<h5 id="第一次校验："><a href="#第一次校验：" class="headerlink" title="第一次校验："></a>第一次校验：</h5><ul>
<li><p>hook<code>System.getProperty</code>方法</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125113128443.png" class="" title="image-20231125113128443">

<ul>
<li>在Smali代码中可以看到它的包名和重载参数</li>
<li>可以写脚本hook返回值</li>
</ul>
</li>
</ul>
<h5 id="第二次校验："><a href="#第二次校验：" class="headerlink" title="第二次校验："></a>第二次校验：</h5><ul>
<li><p>根据代码中的<code>getResources()</code>我们可以知道白名单在资源文件中，位置通常在 <code>res/values/strings.xml</code> 文件中</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125115558462.png" class="" title="image-20231125115558462"></li>
</ul>
<h5 id="校验结果"><a href="#校验结果" class="headerlink" title="校验结果"></a>校验结果</h5><p>写脚本直接修改返回值就可以，之前几篇文章写过很多次了</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125115948170.png" class="" title="image-20231125115948170">

<ul>
<li>通过之后就可以看到app已经进入到了登陆界面</li>
</ul>
<h3 id="登陆"><a href="#登陆" class="headerlink" title="登陆"></a>登陆</h3><p>先随便输入账号密码，看看有什么提示</p>
<blockquote>
<p>提示：“User not recognized”</p>
</blockquote>
<p>那我们就先再jadx中尝试定位这个字符串，在<strong>LoginActivity</strong>中定位到了这个字符串</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125121610998.png" class="" title="image-20231125121610998">

<ul>
<li><p>在这个校验中我们需要先通过用户名的验证：</p>
<ul>
<li>用户名来也来自资源文件，可以直接去刚才找白名单的地方找</li>
</ul>
</li>
<li><p>然后是密码的验证</p>
<ul>
<li><p>通过<code>j()</code>方法的校验就可以，那我们去看一下这个方法</p>
<blockquote>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125171107281.png" class="" title="image-20231125171107281">

<ul>
<li>这里可以看到是对传进来的密码进行了一个摘要算法，然后看结果跟资源文件中保存的password是否相等</li>
<li>去看看资源文件中的password是什么</li>
</ul>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125123009573.png" class="" title="image-20231125123009573">

<ul>
<li><p>用户名是明文：<code>codenameduchess</code></p>
</li>
<li><p>password是一个摘要：<code>84e343a0486ff05530df6c705c8bb4</code></p>
</li>
<li><p>拿这个摘要去网上搜索一下看能不能搜到它的明码</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125123736772.png" class="" title="image-20231125123736772"></li>
</ul>
</blockquote>
</li>
</ul>
</li>
</ul>
<h6 id="验证登陆"><a href="#验证登陆" class="headerlink" title="验证登陆"></a>验证登陆</h6><p>输入我们拿到的用户名和密码</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125124610567.png" class="" title="image-20231125124610567">

<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125124828366.png" class="" title="image-20231125124828366">

<ul>
<li>通过校验，进入了聊天界面，拿到了FLAG</li>
</ul>
<p>登陆完成进入到了聊天框，接下来考虑怎么输入正确的”接头暗号“获取它们都知道的密码</p>
<p>先搜索这些聊天的字符串，看能定位到什么</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125221647017.png" class="" title="image-20231125221647017">

<ul>
<li>看这里的代码逻辑首先，我们先让①、②处的校验通过，然后再保证我们输入的字符串能通过③处的校验</li>
</ul>
<p>①和②处的校验很简单，我们只需要修改<code>a()</code>和<code>b()</code>的返回值就可以通过校验，可以先试一下</p>
<blockquote>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125205819457.png" class="" title="image-20231125205819457">

<p>修改返回值的hook脚本</p>
<pre><code class="js">    Java.use('com.tlamb96.kgbmessenger.MessengerActivity').a.implementation = function(x){
        console.log(x)
        return Java.use('java.lang.String').$new('V@]EAASB\u0012WZF\u0012e,a$7(&amp;am2(3.\u0003')
    }
    Java.use('com.tlamb96.kgbmessenger.MessengerActivity').b.implementation = function(x){
        console.log(x)
        return Java.use('java.lang.String').$new('\u0000dslp}oQ\u0000 dks$|M\u0000h +AYQg\u0000P*!M$gQ\u0000')
    }
</code></pre>
<ul>
<li>这里比较简单就能通过</li>
</ul>
</blockquote>
<p>然后我们来看③处的<code>i()</code>方法</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125210440418.png" class="" title="image-20231125210440418">

<ul>
<li>要对我们输入进来的<strong>q</strong>和<strong>s</strong>进行校验，用返回的值作为FLAG</li>
<li>这里没其它办法我们只能来逆向这个算法，拿到这两个正确的字符串了，如果通过hook直接过来，这两个字符串是空它会嘲笑我们(╬▔皿▔)╯</li>
</ul>
<h3 id="算法逆向"><a href="#算法逆向" class="headerlink" title="算法逆向"></a>算法逆向</h3><p>这两个字符串分别是通过<code>a()</code>和<code>b()</code>校验的，一个一个来分析</p>
<h4 id="a"><a href="#a" class="headerlink" title="a()"></a>a()</h4><img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125222056250.png" class="" title="image-20231125222056250">

<ul>
<li>我们输入的字符串经过<code>a()</code>运算之后需要等于p的值</li>
</ul>
<p>看一下<code>a()</code>的算法</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125222305478.png" class="" title="image-20231125222305478">

<ul>
<li>这只是一个简单的异或算法，根据异或的特性我们知道只需要把结果反过来异或一遍，就能得到原字符串</li>
</ul>
<h6 id="编译dex，并主动调用通过验证"><a href="#编译dex，并主动调用通过验证" class="headerlink" title="编译dex，并主动调用通过验证"></a>编译dex，并主动调用通过验证</h6><p>用Android studio创建一个空的java项目，新建一个类</p>
<pre><code class="java">public class reverseA {
    public static String decode_P(){
        String p = "V@]EAASB\u0012WZF\u0012e,a$7(&amp;am2(3.\u0003";
        String result = a(p);
        return result;
    }
    private static String a(String str) {
        char[] charArray = str.toCharArray();
        for (int i = 0; i &lt; charArray.length / 2; i++) {
            char c = charArray[i];
            charArray[i] = (char) (charArray[(charArray.length - i) - 1] ^ 'A');
            charArray[(charArray.length - i) - 1] = (char) (c ^ '2');
        }
        return new String(charArray);
    }
}
</code></pre>
<ul>
<li><p>将这段代码编译为dex，push到手机上试一下</p>
<blockquote>
<ol>
<li><p>写完代码之后按<code>ctrl + F9</code>构建</p>
</li>
<li><p>然后再文件中找到这个class文件，用d8工具打包成dex</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125221229811.png" class="" title="image-20231125221229811">
</li>
<li><p>push到手机上</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125221406006.png" class="" title="image-20231125221406006"></li>
</ol>
</blockquote>
</li>
</ul>
<h6 id="写个js脚本调用这个dex"><a href="#写个js脚本调用这个dex" class="headerlink" title="写个js脚本调用这个dex"></a>写个js脚本调用这个dex</h6><pre><code class="js">Java.perform(function(){
    Java.openClassFile("/data/local/tmp/classes.dex").load();
    var reverseA =Java.use("com.xiaoeryu.lesson9.reverseA");
    console.log(reverseA.decode_P());
}); 
</code></pre>
<p>计算结果：</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125222751338.png" class="" title="image-20231125222751338">

<p>测试：</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125223008964.png" class="" title="image-20231125223008964">

<ul>
<li>测试ok</li>
<li>接下来分析第二个字符串</li>
</ul>
<h4 id="b"><a href="#b" class="headerlink" title="b()"></a>b()</h4><img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125223416442.png" class="" title="image-20231125223416442">

<ul>
<li>同样，这里也是将我们输入的字符串经过<code>b()</code>运算后要等于<code>r</code>的值</li>
</ul>
<p>看一下<code>b()</code>方法</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125223711810.png" class="" title="image-20231125223711810">

<ul>
<li><p>可以看到这个算法就比之前的稍微要麻烦一点，里面有移位、异或、逆序交换</p>
</li>
<li><p>我们先来分析一下</p>
<blockquote>
<p>总共分为两部分：</p>
<ol>
<li><code>((charArray[i] &gt;&gt; (i % 8)) ^ charArray[i])</code>这是一个简单的位运算，通过右移然后异或，对字符进行了加密</li>
<li>第二部分是将加密后的字符进行逆序交换</li>
</ol>
</blockquote>
</li>
</ul>
<p>分析完成了我们来写一下它的解密算法：写python脚本暴力枚举所有字符就可以。<em>当然写在Android Studio写成Java代码编译成一个dex用注入的方式获取同样也是可以的，代码放在附件中（注入的流程跟解密<code>a()</code>方法相同）。</em></p>
<pre><code class="python">characterSet = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789!\"#$%&amp;'()*+,-./:;&lt;=&gt;?@[\\]^_`{|}~ \t\n\r"
characterSetArray = list(characterSet)

EnStr = "\000dslp}oQ\000 dks$|M\000h +AYQg\000P*!M$gQ\000"
EnStrArray = list(EnStr)

# 把EnStrArray进行逆序交换
for i in range(int(len(EnStrArray)/2)):
    c = EnStrArray[i]
    EnStrArray[i] = EnStrArray[len(EnStrArray)-i-1]
    EnStrArray[len(EnStrArray)-i-1] = c

# 暴力枚举EnStrArray的明文
raw_text = ""
for i in range(len(EnStrArray)):
    for j in range(len(characterSetArray)):
        c = characterSetArray[j]
        result = chr((ord(c) &gt;&gt; (i % 8)) ^ ord(c))
        if result == EnStrArray[i]:
            raw_text += c
            break

print(raw_text)
</code></pre>
<p>执行结果：</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231126163043261.png" class="" title="image-20231126163043261">

<p>将结果输入：</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231126163659903.png" class="" title="image-20231126163659903">

<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231126163607474.png" class="" title="image-20231126163607474">



<p>android_studio编写部分的<a class="link" target="_blank" rel="noopener" href="https://github.com/xiaoeeyu/KGB_Messenger_Decoder/tree/master">代码<i class="fa-solid fa-arrow-up-right ml-[0.2em] font-light align-text-top text-[0.7em] link-icon"></i></a></p>
<hr>
<h3 id="Z3"><a href="#Z3" class="headerlink" title="Z3"></a>Z3</h3><p>本来<code>b()</code>是打算用<strong>Z3</strong>解的，但是打印字符串结果的时候一致提示溢出，只好自己手动解了。这里记录一下流程和思路</p>
<blockquote>
<p>因为<code>r</code>字符串有很多不可见字符串，先把它变为可见字符串</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231126173232715.png" class="" title="image-20231126173232715">

<p>同样的，构建 &gt; d8编译为dex &gt; push到手机 &gt; 执行脚本</p>
<p>脚本也添加一个<code>console.log</code></p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231125231137756.png" class="" title="image-20231125231137756">

<p>然后，对与它的算法这里我们暂时先不分析，用<a target="_blank" rel="noopener" href="https://github.com/Z3Prover/z3"><strong>Z3</strong></a>试试能不能直接解开</p>
<ul>
<li>Z3是一个基于符号执行的函数求解的工具</li>
</ul>
<pre><code class="js">from z3 import *
from binascii import b2a_hex, a2b_hex

# 创建一个Z3 solver对象
s = Solver()

# 待解密的十六进制字符串
r = "0064736c707d6f510020646b73247c4d0068202b4159516700502a214d24675100"

# 将十六进制字符串转换为字节数组
r_result = bytearray(a2b_hex(r))
print(r_result)

# 逆序交换字节数组中的每个字节
for i in range(int(len(r_result)/2)):
    c = r_result[i]
    r_result[i] = r_result[len(r_result)-i-1]
    r_result[len(r_result)-i-1] = c
print(b2a_hex(r_result))

# 创建Z3的BitVec变量列表，每个变量代表一个字节
x = [BitVec("x%s" % i, 32) for i in range(len(r_result))]

# 添加Z3 solver的约束条件
for i in range(len(r_result)):
    c = r_result[i]
    # 将解密过程表示为Z3约束
    s.add(((x[i] &gt;&gt; (i % 8)) ^ x[i]) == r_result[i])

# 检查是否存在解
if s.check() == sat:
    # 获取解
    model = s.model()
    print(model)

    # 解密后的整数值列表
    decoded_values = []
    for i in range(len(r_result)):
        if model[x[i]] is not None:
            decoded_values.append(model[x[i]].as_long().real)
        else:
            decoded_values.append(0)
    print("Decrypted as integers:", decoded_values)

    # 解密后的十六进制表示列表
    print("Decrypted as hex:", [hex(val) for val in decoded_values])

# 注释掉的部分是将解密后的整数值转换为字符串的代码
# if (s.check() == sat):
#     model = s.model()
#     print(model)
#     flag = ""
#     for i in range(len(r_result)):
#         if (model[x[i]] != None):
#             flag += chr(model[x[i]].as_long().real)
#         else:
#             flag += " "
#     print('"' + flag + '"')
#     print(len(flag), len(r_result))
</code></pre>
<ul>
<li><p>整数和16进制形式打印</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231126173636593.png" class="" title="image-20231126173636593">
</li>
<li><p>字符串形式打印出错</p>
<img lazyload="" src="/images/loading.svg" data-src="/2023/11/26/KGBMessager%E8%A7%A3%E5%AF%86/image-20231126173722880.png" class="" title="image-20231126173722880"></li>
</ul>
</blockquote>
<p>参考文章：</p>
<p><a class="link" target="_blank" rel="noopener" href="https://blog.csdn.net/siritobla/article/details/123956940">KGB Messenger解题流程<i class="fa-solid fa-arrow-up-right ml-[0.2em] font-light align-text-top text-[0.7em] link-icon"></i></a></p>

		</div>

		
		<div class="post-copyright-info w-full my-8 px-2 sm:px-6 md:px-8">
			<div class="article-copyright-info-container">
    <ul>
        <li><strong>标题:</strong> KGBMessager解密</li>
        <li><strong>作者:</strong> xiaoeryu</li>
        <li><strong>创建于
                :</strong> 2023-11-26 16:49:53</li>
        
            <li>
                <strong>更新于
                    :</strong> 2023-11-26 20:51:15
            </li>
        
        <li>
            <strong>链接:</strong> https://github.com/xiaoeryu/2023/11/26/KGBMessager解密/
        </li>
        <li>
            <strong>
                版权声明:
            </strong>
            

            
                本文章采用 <a class="license" target="_blank" rel="noopener" href="https://creativecommons.org/licenses/by-nc-sa/4.0">CC BY-NC-SA 4.0</a> 进行许可。
            
        </li>
    </ul>
</div>

		</div>
		

		
		<ul class="post-tags-box text-lg mt-1.5 flex-wrap justify-center flex md:hidden">
			
			<li class="tag-item mx-0.5">
				<a href="/tags/Frida%E9%80%86%E5%90%91%E4%B8%8E%E5%88%A9%E7%94%A8%E8%87%AA%E5%8A%A8%E5%8C%96/">#Frida逆向与利用自动化</a>&nbsp;
			</li>
			
			<li class="tag-item mx-0.5">
				<a href="/tags/Frida-HOOK/">#Frida HOOK</a>&nbsp;
			</li>
			
			<li class="tag-item mx-0.5">
				<a href="/tags/%E7%AE%97%E6%B3%95%E5%88%86%E6%9E%90/">#算法分析</a>&nbsp;
			</li>
			
		</ul>
		

		

		
		<div class="article-nav my-8 flex justify-between items-center px-2 sm:px-6 md:px-8">
			
			<div class="article-prev border-border-color shadow-redefine-flat shadow-shadow-color-2 rounded-medium px-4 py-2 hover:shadow-redefine-flat-hover hover:shadow-shadow-color-2">
				<a class="prev" rel="prev" href="/2023/12/02/Hook%E6%9E%84%E9%80%A0%E5%87%BD%E6%95%B0/">
					<span class="left arrow-icon flex justify-center items-center">
						<i class="fa-solid fa-chevron-left"></i>
					</span>
					<span class="title flex justify-center items-center">
						<span class="post-nav-title-item">Hook构造函数</span>
						<span class="post-nav-item">上一篇</span>
					</span>
				</a>
			</div>
			
			
			<div class="article-next border-border-color shadow-redefine-flat shadow-shadow-color-2 rounded-medium px-4 py-2 hover:shadow-redefine-flat-hover hover:shadow-shadow-color-2">
				<a class="next" rel="next" href="/2023/11/24/RPC%E6%A6%82%E5%BF%B5%E5%92%8C%E5%AE%9E%E4%BE%8B/">
					<span class="title flex justify-center items-center">
						<span class="post-nav-title-item">RPC概念和实例</span>
						<span class="post-nav-item">下一篇</span>
					</span>
					<span class="right arrow-icon flex justify-center items-center">
						<i class="fa-solid fa-chevron-right"></i>
					</span>
				</a>
			</div>
			
		</div>
		


		
		<div class="comment-container px-2 sm:px-6 md:px-8 pb-8">
			<div class="comments-container mt-10 w-full ">
    <div id="comment-anchor" class="w-full h-2.5"></div>
    <div class="comment-area-title w-full my-1.5 md:my-2.5 text-xl md:text-3xl font-bold">
        评论
    </div>
    

        
            


        
    
</div>

		</div>
		
	</div>

	
	<div class="toc-content-container">
		<div class="post-toc-wrap">
	<div class="post-toc">
		<div class="toc-title">目录</div>
		<div class="page-title">KGBMessager解密</div>
		<ol class="nav"><li class="nav-item nav-level-4"><a class="nav-link" href="#%E6%83%AF%E4%BE%8B%E5%85%88%E7%94%A8jadx%E6%89%93%E5%BC%80%E6%8B%BF%E5%88%B0%E5%8C%85%E5%90%8D%EF%BC%8C%E7%84%B6%E5%90%8E%E7%94%A8objection%E6%9F%A5%E7%9C%8B%E4%B8%80%E4%B8%8B%E5%9F%BA%E6%9C%AC%E4%BF%A1%E6%81%AF"><span class="nav-text">惯例先用jadx打开拿到包名，然后用objection查看一下基本信息</span></a></li></ol></li></ol></li><li class="nav-item nav-level-2"><a class="nav-link" href="#%E5%BC%80%E5%A7%8B%E5%88%86%E6%9E%90"><span class="nav-text">开始分析</span></a><ol class="nav-child"><li class="nav-item nav-level-3"><a class="nav-link" href="#%E9%80%9A%E8%BF%87%E5%9C%B0%E5%8C%BA%E6%A0%A1%E9%AA%8C"><span class="nav-text">通过地区校验</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E7%99%BB%E9%99%86"><span class="nav-text">登陆</span></a></li><li class="nav-item nav-level-3"><a class="nav-link" href="#%E7%AE%97%E6%B3%95%E9%80%86%E5%90%91"><span class="nav-text">算法逆向</span></a><ol class="nav-child"><li class="nav-item nav-level-4"><a class="nav-link" href="#a"><span class="nav-text">a()</span></a></li><li class="nav-item nav-level-4"><a class="nav-link" href="#b"><span class="nav-text">b()</span></a></li></ol></li><li class="nav-item nav-level-3"><a class="nav-link" href="#Z3"><span class="nav-text">Z3</span></a>

	</div>
</div>
	</div>
	
</div>
			</div>

			
		</div>

		<div class="main-content-footer">
			<footer class="footer mt-5 py-5 h-auto text-base text-third-text-color relative border-t-2 border-t-border-color">
    <div class="info-container py-3 text-center">
        
        <div class="text-center">
            &copy;
            
              <span>2022</span>
              -
            
            2025&nbsp;&nbsp;<i class="fa-solid fa-heart fa-beat" style="--fa-animation-duration: 0.5s; color: #f54545"></i>&nbsp;&nbsp;<a href="/">xiaoeryu</a>
            
                
                <p class="post-count space-x-0.5">
                    <span>
                        共撰写了 112 篇文章
                    </span>
                    
                </p>
            
        </div>
        
            <script data-swup-reload-script src="https://busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script>
            <div class="relative text-center lg:absolute lg:right-[20px] lg:top-1/2 lg:-translate-y-1/2 lg:text-right">
                
                    <span id="busuanzi_container_site_uv" class="lg:!block">
                        <span class="text-sm">访问人数</span>
                        <span id="busuanzi_value_site_uv"></span>
                    </span>
                
                
                    <span id="busuanzi_container_site_pv" class="lg:!block">
                        <span class="text-sm">总访问量</span>
                        <span id="busuanzi_value_site_pv"></span>
                    </span>
                
            </div>
        
        <div class="relative text-center lg:absolute lg:left-[20px] lg:top-1/2 lg:-translate-y-1/2 lg:text-left">
            <span class="lg:block text-sm">由 <?xml version="1.0" encoding="utf-8"?><!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd"><svg class="relative top-[2px] inline-block align-baseline" version="1.1" id="圖層_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="1rem" height="1rem" viewBox="0 0 512 512" enable-background="new 0 0 512 512" xml:space="preserve"><path fill="#0E83CD" d="M256.4,25.8l-200,115.5L56,371.5l199.6,114.7l200-115.5l0.4-230.2L256.4,25.8z M349,354.6l-18.4,10.7l-18.6-11V275H200v79.6l-18.4,10.7l-18.6-11v-197l18.5-10.6l18.5,10.8V237h112v-79.6l18.5-10.6l18.5,10.8V354.6z"/></svg><a target="_blank" class="text-base" href="https://hexo.io">Hexo</a> 驱动</span>
            <span class="text-sm lg:block">主题&nbsp;<a class="text-base" target="_blank" href="https://github.com/EvanNotFound/hexo-theme-redefine">Redefine v2.8.2</a></span>
        </div>
        
        
            <div>
                博客已运行 <span class="odometer" id="runtime_days" ></span> 天 <span class="odometer" id="runtime_hours"></span> 小时 <span class="odometer" id="runtime_minutes"></span> 分钟 <span class="odometer" id="runtime_seconds"></span> 秒
            </div>
        
        
            <script data-swup-reload-script>
                try {
                    function odometer_init() {
                    const elements = document.querySelectorAll('.odometer');
                    elements.forEach(el => {
                        new Odometer({
                            el,
                            format: '( ddd).dd',
                            duration: 200
                        });
                    });
                    }
                    odometer_init();
                } catch (error) {}
            </script>
        
        
        
    </div>  
</footer>
		</div>
	</div>

	
	<div class="post-tools">
		<div class="post-tools-container">
	<ul class="article-tools-list">
		<!-- TOC aside toggle -->
		
		<li class="right-bottom-tools page-aside-toggle">
			<i class="fa-regular fa-outdent"></i>
		</li>
		

		<!-- go comment -->
		
		<li class="go-comment">
			<i class="fa-regular fa-comments"></i>
		</li>
		
	</ul>
</div>
	</div>
	

	<div class="right-side-tools-container">
		<div class="side-tools-container">
	<ul class="hidden-tools-list">
		<li class="right-bottom-tools tool-font-adjust-plus flex justify-center items-center">
			<i class="fa-regular fa-magnifying-glass-plus"></i>
		</li>

		<li class="right-bottom-tools tool-font-adjust-minus flex justify-center items-center">
			<i class="fa-regular fa-magnifying-glass-minus"></i>
		</li>

		<li class="right-bottom-tools tool-dark-light-toggle flex justify-center items-center">
			<i class="fa-regular fa-moon"></i>
		</li>

		<!-- rss -->
		

		

		<li class="right-bottom-tools tool-scroll-to-bottom flex justify-center items-center">
			<i class="fa-regular fa-arrow-down"></i>
		</li>
	</ul>

	<ul class="visible-tools-list">
		<li class="right-bottom-tools toggle-tools-list flex justify-center items-center">
			<i class="fa-regular fa-cog fa-spin"></i>
		</li>
		
		<li class="right-bottom-tools tool-scroll-to-top flex justify-center items-center">
			<i class="arrow-up fas fa-arrow-up"></i>
			<span class="percent"></span>
		</li>
		
		
	</ul>
</div>
	</div>

	<div class="image-viewer-container">
	<img src="">
</div>

	
	<div class="search-pop-overlay">
	<div class="popup search-popup">
		<div class="search-header">
			<span class="search-input-field-pre">
				<i class="fa-solid fa-keyboard"></i>
			</span>
			<div class="search-input-container">
				<input autocomplete="off" autocorrect="off" autocapitalize="off" placeholder="站内搜索您需要的内容..." spellcheck="false" type="search" class="search-input">
			</div>
			<span class="popup-btn-close">
				<i class="fa-solid fa-times"></i>
			</span>
		</div>
		<div id="search-result">
			<div id="no-result">
				<i class="fa-solid fa-spinner fa-spin-pulse fa-5x fa-fw"></i>
			</div>
		</div>
	</div>
</div>
	

</main>



<script src="/js/build/libs/Swup.min.js"></script>

<script src="/js/build/libs/SwupSlideTheme.min.js"></script>

<script src="/js/build/libs/SwupScriptsPlugin.min.js"></script>

<script src="/js/build/libs/SwupProgressPlugin.min.js"></script>

<script src="/js/build/libs/SwupScrollPlugin.min.js"></script>

<script src="/js/build/libs/SwupPreloadPlugin.min.js"></script>

<script>
    const swup = new Swup({
        plugins: [
            new SwupScriptsPlugin({
                optin: true,
            }),
            new SwupProgressPlugin(),
            new SwupScrollPlugin({
                offset: 80,
            }),
            new SwupSlideTheme({
                mainElement: ".main-content-body",
            }),
            new SwupPreloadPlugin(),
        ],
        containers: ["#swup"],
    });
</script>




	
<script src="/js/build/tools/imageViewer.js" type="module"></script>

<script src="/js/build/utils.js" type="module"></script>

<script src="/js/build/main.js" type="module"></script>

<script src="/js/build/layouts/navbarShrink.js" type="module"></script>

<script src="/js/build/tools/scrollTopBottom.js" type="module"></script>

<script src="/js/build/tools/lightDarkSwitch.js" type="module"></script>

<script src="/js/build/layouts/categoryList.js" type="module"></script>



    
<script src="/js/build/tools/localSearch.js" type="module"></script>




    
<script src="/js/build/tools/codeBlock.js" type="module"></script>




    
<script src="/js/build/layouts/lazyload.js" type="module"></script>




    
<script src="/js/build/tools/runtime.js"></script>

    
<script src="/js/build/libs/odometer.min.js"></script>

    
<link rel="stylesheet" href="/assets/odometer-theme-minimal.css">




  
<script src="/js/build/libs/Typed.min.js"></script>

  
<script src="/js/build/plugins/typed.js" type="module"></script>








    
<script src="/js/build/libs/anime.min.js"></script>





    
<script src="/js/build/tools/tocToggle.js" type="module" data-swup-reload-script=""></script>

<script src="/js/build/layouts/toc.js" type="module" data-swup-reload-script=""></script>

<script src="/js/build/plugins/tabs.js" type="module" data-swup-reload-script=""></script>




<script src="/js/build/libs/moment-with-locales.min.js" data-swup-reload-script=""></script>


<script src="/js/build/layouts/essays.js" type="module" data-swup-reload-script=""></script>





	
</body>

</html>